Facebook's vast data stockpiling business has been referred to the European Union's top court by Ireland's information watchdog—thereby intensifying the debate around a proposed EU-US data transfer pact dubbed Privacy Shield.

Further Reading

Ars understands that papers will be lodged in the courts six days from now.

Facebook—which has its European headquarters in Ireland, a country known for its lax approach to data laws—could face questions from the CJEU about the validity of the contractual clauses it uses to transfer data outside of the 28-member-state bloc.

It comes after the 15-year-old Safe Harbour agreement between Europe and the US was deemed invalid in October last year, following a complaint from Austrian law student and privacy campaigner Max Schrems, who looked at US data-hoarding giants accused of leaking personal information to the NSA—before zeroing in on Facebook's alleged misuse of personal data.

Since then, Eurocrats and their American counterparts have been attempting to thrash out a deal to replace the scrapped data-sharing arrangement between the EU and US. However, the planned successor, Privacy Shield, continues to concern data watchdogs.

“We continue to thoroughly and diligently investigate Mr Schrems’ complaint to ensure the adequate protection of personal data," a spokesperson at the Irish DPC said.

"We yesterday [on Tuesday] informed Mr Schrems and Facebook of our intention to seek declaratory relief in the Irish High Court and a referral to the CJEU to determine the legal status of data transfers under Standard Contractual Clauses. We will update all relevant parties as our investigation continues.”

On the thorny issue of "model contracts" used by the likes of Facebook, Google, et al, Schrems said: “This is a very serious issue for the US tech industry and EU-US data flows. As long as far-reaching US surveillance laws apply to them, any legal basis will be subject to invalidation or limitations under EU fundamental right."

Model contracts, in the eyes of European law, are contractual clauses that "provide adequate safeguards with respect to the protection of the privacy and fundamental rights and freedoms of individuals and as regards the exercise of the corresponding rights."

Further Reading

Schrems added: "There is no way that the CJEU can say that model contracts are valid if they killed Safe Harbour based on the existence of these US surveillance laws. All data protection lawyers knew that model contracts were a shaky thing, but it was so far the easiest and quickest solution they came up with. As long as the US does not substantially change its laws I don’t see now there could be a solution."

Facebook reiterated its previous comments about model contracts, saying that—setting aside the invalid Safe Harbour agreement—thousands of companies rely on a variety of different methods "prescribed by EU law" to legally transfer data to the US from Europe.

But if those contracts are deemed invalid by the CJEU, and the new Privacy Shield doesn't work out, transferring data between the EU and US may soon be very difficult indeed.